24 May 2006 | 3,796 views

Security Researchers Afraid to Reveal Vulnerabilities

Check For Vulnerabilities with Acunetix

Well it happened a while back, remember? The French researcher Guillaume Tena who got in trouble for breaching French copywrite laws by decompiling some software.

Now people are generally starting to worry about disclosing vulnerabilities through any channels, does there need to be some kind of anonymous PGP key based system for vulnerability disclosure? So people can do it without fear of getting sued?

The CERIAS weblog examines the risks associated with reporting vulnerabilities. In the end, he advises that the risks (in one situation, at least) were almost not worth the trouble, and gives advice on how to stay out of trouble. Is it worth it to report vulnerabilities despite the risks, or is the chilling effect demonstrated here too much?

A typical difficulty encountered by vulnerability researchers is that administrators or programmers often deny that a problem is exploitable or is of any consequence, and request a proof. This got Eric McCarty in trouble & the proof is automatically a proof that you breached the law, and can be used to prosecute you!

It’s an interesting point when it comes to public disclosure, unless you have permission, how do you prove you’ve found a vulnerability without getting in trouble?

HD Moore also discussed this recently with:

Breach case could curtail Web flaw finders



Recent in Exploits/Vulnerabilities:
- XML Quadratic Blowup Attack Blows Up WordPress & Drupal
- Password Manager Security – LastPass, RoboForm Etc Are Not That Safe
- Hacking Your Fridge – Internet of Things Security

Related Posts:
- 3Com’s TippingPoint Finds New IE Vulnerabilities
- What Responsibility do Anti-Spyware Researchers Have?
- Sandcat by Syhunt – Web Server & Application Vulnerability Scanner

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 227,323 views
- AJAX: Is your application secure enough? - 119,084 views
- eEye Launches 0-Day Exploit Tracker - 85,051 views

Low-cost VPS Hosting

Comments are closed.